[Git][security-tracker-team/security-tracker][master] automatic NOT-FOR-US entries update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 9 08:14:53 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3080defe by security tracker role at 2026-10-09T07:14:46+00:00
automatic NOT-FOR-US entries update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,9 +1,9 @@
CVE-2026-9209 (mJobTime through build 15.7.3.32 contains an unauthenticated SQL execu ...)
TODO: check
CVE-2026-97076 (Executable Regular Expression Error vulnerability in WP Media WP Rocke ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-96207 (Improper certificate validation in Microsoft Partner Center allows an ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-95210 (Improper certificate validation in gnutls v3.8.13 causes the applicati ...)
TODO: check
CVE-2026-95209 (An issue in gnutls v3.8.13 causes legitimate CA certificates to be rej ...)
@@ -17,21 +17,21 @@ CVE-2026-95125 (libming through 0.4.8 contains a heap buffer overflow in r_readc
CVE-2026-95116 (An issue in libming through 0.4.8 allows a remote attacker to cause a ...)
TODO: check
CVE-2026-94510 (Authorization bypass through user-controlled key in Microsoft Bookings ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-93699 (Argument injection in WP Toolkit for cPanel allows local users to exec ...)
TODO: check
CVE-2026-93548 (The FooSales WordPress plugin before 1.43.3 does not verify that an a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93509 (The Wallet System for WooCommerce WordPress plugin before 2.8.0 does n ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-93034 (SGLang contains an arbitrary code execution vulnerability caused by th ...)
TODO: check
CVE-2026-93017 (The `insights-operator-gather` ClusterRole grants the operator's servi ...)
TODO: check
CVE-2026-92990 (The SendPress Newsletters WordPress plugin through 1.26.1.20 protects ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92989 (The SendPress Newsletters WordPress plugin through 1.26.1.20 does not ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-92555 (Insertion of sensitive information into sent data vulnerability in AKI ...)
TODO: check
CVE-2026-91844 (Unrestricted upload of file with dangerous type vulnerability in \u013 ...)
@@ -43,7 +43,7 @@ CVE-2026-89191 (Unsanitised input in the "template name" field of SQLView KRIS's
CVE-2026-89091 (A flaw was found in ansible-core. When installing a collection with `a ...)
TODO: check
CVE-2026-88931 (The Social Web Suite WordPress plugin through 4.1.12 does not restric ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-88648 (Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers con ...)
TODO: check
CVE-2026-88647 (A hostname verification bypass in GnuTLS v3.8.13 allows attackers to c ...)
@@ -51,11 +51,11 @@ CVE-2026-88647 (A hostname verification bypass in GnuTLS v3.8.13 allows attacker
CVE-2026-88257 (Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKit ...)
TODO: check
CVE-2026-88131 (Deserialization of untrusted data in Microsoft Dataverse allows an una ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-87980 (IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-87841 (The UnitechPay WordPress plugin through 1.0.6.3 does not verify the a ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-87110 (An unauthenticated user with network access to the Ops Manager web por ...)
TODO: check
CVE-2026-87109 (An authenticated Ops Manager organization member can retrieve another ...)
@@ -63,109 +63,109 @@ CVE-2026-87109 (An authenticated Ops Manager organization member can retrieve an
CVE-2026-87108 (An authenticated Ops Manager user with a read-only project role can re ...)
TODO: check
CVE-2026-86850 (The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-84891 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84875 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84290 (IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improp ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84278 (IBM Guardium Data Protection 12.2 is affected by a command injection v ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84276 (IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84275 (IBM Guardium Data Protection 12.2 is vulnerable to path traversal in t ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84274 (IBM Guardium Data Protection 12.2.2 is affected by a sensitive informa ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84272 (IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84271 (IBM Guardium Data Protection 12.2 is vulnerable to a signature verific ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84250 (IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptograp ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84249 (IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84247 (IBM Guardium Data Protection 12.2 could allow a remote authenticated a ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84246 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84245 (IBM Guardium Data Protection 12.2 is vulnerable to a local privilege e ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84244 (IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protectio ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84230 (IBM Guardium Data Protection 12.2.2 could allow a remote attacker to c ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84209 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84198 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84058 (IBM Guardium Data Protection 12.0, 12.1, and 12.2is vulnerable to a bu ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84057 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84035 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-84032 (IBM Guardium Data Protection 12.2.2 could allow a remote attacker to c ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-83947 (Missing authorization in Azure Event Grid allows an authorized attacke ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-83943 (Exposure of sensitive information to an unauthorized actor in Azure AP ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-82900 (IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote att ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82895 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82344 (IBM Guardium Data Protection 12.0, 12.1is vulnerable to a heap-based b ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82335 (IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap- ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-82334 (IBM Guardium Data Protection 12.0, 12.1, 12.2is vulnerable to a heap-b ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-81932 (IBM Guardium Data Protection 12.0, 12.1, and 12.2is vulnerable to SQL ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-81929 (The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-80381 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-7827 (A stack-based buffer overflow in the _RdbLoadEntity function of the RD ...)
TODO: check
CVE-2026-7826 (A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer ...)
TODO: check
CVE-2026-79842 (An authentication bypass vulnerability exists in HPE Intelligent Manag ...)
- TODO: check
+ NOT-FOR-US: HPE
CVE-2026-78407 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78406 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78401 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78399 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-78388 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-77900 (Missing authentication for critical function in Azure App Service allo ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-75875 (IBM Guardium Data Protection 12.0, 12.1, and 12.2could allow a remote ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-71896 (An authorization vulnerability in Apache DolphinScheduler allows authe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71895 (An authorization vulnerability in Apache DolphinScheduler allows authe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-71183 (An authorization vulnerability in Apache DolphinScheduler allows authe ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-69435 (Missing authorization in Azure SRE Agent allows an authorized attacker ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2026-67693 (An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive inf ...)
TODO: check
CVE-2026-66479 (Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / Stella ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-66087 (An authorization bypass vulnerability in Apache DolphinScheduler allow ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-66084 (An authorization bypass vulnerability in Apache DolphinScheduler allow ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-66082 (An authorization bypass vulnerability in Apache DolphinScheduler allow ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-62181
REJECTED
CVE-2026-62171
@@ -179,19 +179,19 @@ CVE-2026-62166
CVE-2026-62163
REJECTED
CVE-2026-62142 (Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62128 (Missing Authorization vulnerability in Creator LMS Creator LMS creator ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-62127 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-61801 (The `github.com/moby/sys/user` package provides Go utilities for parsi ...)
TODO: check
CVE-2026-5759 (A double free and use-after-free vulnerability in the RdbLoadDeletedNo ...)
TODO: check
CVE-2026-50055 (A policy-enforcement flaw in Zimbra Collaboration Suite allows an auth ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-50054 (An authorization flaw in Zimbra Collaboration Suite\u2019s GrantRights ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-4894 (A vulnerability has been identified regarding insufficient validation ...)
TODO: check
CVE-2026-44038 (A global out-of-bounds read in the Huffman decoder of the bundled IJG ...)
@@ -209,139 +209,139 @@ CVE-2026-44033 (Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode
CVE-2026-44031 (Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read ...)
TODO: check
CVE-2026-42698 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-40804 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-27420 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-19878 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19585 (HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions b ...)
TODO: check
CVE-2026-19498 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19494 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19493 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19491 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19482 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-19218 (Weak Password Recovery Mechanism for Forgotten Password vulnerability ...)
TODO: check
CVE-2026-19083 (Authorization bypass through User-Controlled key vulnerability in AKIN ...)
TODO: check
CVE-2026-18740 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-17189 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16916 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16830 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16823 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16340 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16182 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16181 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16179 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16178 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16177 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16176 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16170 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16169 (IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote a ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16167 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16165 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16164 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16163 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16161 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16159 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-16111 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15824 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15822 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15819 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15784 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15781 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-15762 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14999 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14992 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14991 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14990 (IBM DataPower Gateway 10.6.0.0 through 10.6.0.10is vulnerable to cross ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14988 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14905 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14888 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14521 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14509 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14508 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14507 (IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote a ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14502 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14497 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14496 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14273 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-14269 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-13258 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-13257 (IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6. ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12859 (Missing Authorization vulnerability in Caz Informatics Services Trade ...)
TODO: check
CVE-2026-12260 (SQL injection in the NetBoard CRM demo platform; specifically, the vul ...)
TODO: check
CVE-2026-12109 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-12091 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11939 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11936 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11930 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11888 (IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identi ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2026-11318 (Deskin through 3.3.4.3 contains a privilege escalation vulnerability i ...)
TODO: check
CVE-2026-10631 (An authorization bypass in the EWS FindItem handler of Zimbra Collabor ...)
- TODO: check
+ NOT-FOR-US: Zimbra
CVE-2026-107914 (Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't suffici ...)
TODO: check
CVE-2026-107911 (A type confusion vulnerability in the _read_flags function (src/comman ...)
@@ -455,7 +455,7 @@ CVE-2026-107708 (MIT krb5 through 1.22.2 contains a NULL pointer dereference vul
CVE-2026-107707 (Intego Antivirus for Windows through 3.0.0.1 contains a link following ...)
TODO: check
CVE-2026-107706 (Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vul ...)
- TODO: check
+ NOT-FOR-US: Dolibarr
CVE-2026-107705 (Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow ...)
TODO: check
CVE-2026-107704 (The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS comman ...)
@@ -517,7 +517,7 @@ CVE-2026-107612 (Incorrect permission assignment in GlavSoft TightVNC Server for
CVE-2026-107611 (An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft Ti ...)
TODO: check
CVE-2026-107608 (Improper link resolution before file access in the asset bundling outp ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-107604 (A flaw was found in the installation provider and client registration ...)
TODO: check
CVE-2026-107589 (Insufficient job validation for service accounts in Jacamar CI prior t ...)
@@ -565,7 +565,7 @@ CVE-2026-107503 (Unvalidated environments URL allows OAuth authorization code +
CVE-2026-107466 (A flaw was found in flatpak-builder. This vulnerability allows an atta ...)
TODO: check
CVE-2026-107406 (Memory overflow vulnerability leading to Remote Code Execution or Deni ...)
- TODO: check
+ NOT-FOR-US: NetScaler
CVE-2026-107399 (The Mechanize library is used for automating interaction with websites ...)
TODO: check
CVE-2026-107397 (Indico is an event management system that uses Flask-Multipass, a mult ...)
@@ -627,13 +627,13 @@ CVE-2026-107334 (Malcolm's nginx Lua role-based access control (RBAC) layer deci
CVE-2026-107333 (Malcolm's nginx based reverse proxy contains a URL path normalization ...)
TODO: check
CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection handler in AW ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go Driver ca ...)
TODO: check
CVE-2026-107324 (An integer overflow in BSON value-length handling in the MongoDB Go Dr ...)
TODO: check
CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent Plugins for AW ...)
- TODO: check
+ NOT-FOR-US: Amazon
CVE-2026-107318 (@fastify/reply-from is a Fastify plugin that forwards requests to an u ...)
TODO: check
CVE-2026-107303 (JHipster is a development platform to quickly generate, develop, and d ...)
@@ -675,13 +675,13 @@ CVE-2026-107286 (Pydantic AI is a Python agent framework for building applicatio
CVE-2026-107275 (@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. ...)
TODO: check
CVE-2026-106611 (Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106603 (Authorization Bypass Through User-Controlled Key vulnerability in Grou ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106600 (Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP g ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106596 (Missing Authorization vulnerability in Visual Composer Visual Composer ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-106438 (An incorrect calculation in Decimal128 string parsing in the MongoDB C ...)
TODO: check
CVE-2026-106437 (The BSON buffer-reservation API in the MongoDB C Driver can record a l ...)
@@ -709,23 +709,23 @@ CVE-2026-106177 (A kernel buffer overflow vulnerability in HP Sure Click version
CVE-2026-106126 (A command injection vulnerability in the Active Directory Events Liste ...)
TODO: check
CVE-2026-106097 (The Code Snippets WordPress plugin before 3.10.0 does not sanitise and ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-106095 (The Code Snippets WordPress plugin before 3.10.0 does not perform a ca ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105893 (Authorization Bypass Through User-Controlled Key vulnerability in Liqu ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105891 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105890 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105888 (Missing Authorization vulnerability in Liquid Web / StellarWP Event Ti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105887 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105886 (Missing Authorization vulnerability in BdThemes Ultimate Post Kit ulti ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105878 (Missing Authorization vulnerability in YITH YITH WooCommerce Product B ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105833 (EspoCRM before 10.0.5 contains an insecure direct object reference vul ...)
TODO: check
CVE-2026-105832 (EspoCRM before 10.0.6 contains an authentication bypass vulnerability ...)
@@ -737,7 +737,7 @@ CVE-2026-105830 (league/commonmark from 2.0.0 before 2.10.2 contains a quadratic
CVE-2026-105829 (League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scrip ...)
TODO: check
CVE-2026-105828 (Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 cont ...)
- TODO: check
+ NOT-FOR-US: Parse Server
CVE-2026-105827 (ImageMagick before 7.1.2-30 and 6.9.13-55 contains an uncontrolled rec ...)
TODO: check
CVE-2026-105826 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a securi ...)
@@ -749,17 +749,17 @@ CVE-2026-105824 (ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a
CVE-2026-105823 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 lacks a security ...)
TODO: check
CVE-2026-105674 (TP-Link Tapo C325WB V2 generates the pre-shared key used by its local ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105673 (An unauthenticated denial-of-service vulnerability exists in Tapo C325 ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105672 (TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypas ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-105570 (Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitiv ...)
TODO: check
CVE-2026-105452 (Docker Sandboxes could forward a client-supplied credential alongside ...)
TODO: check
CVE-2026-105436 (Deserialization of Untrusted Data vulnerability in MainWP MainWP Child ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105405 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains an inval ...)
TODO: check
CVE-2026-105404 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a code i ...)
@@ -777,25 +777,25 @@ CVE-2026-105399 (ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 contains a
CVE-2026-105398 (ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerabil ...)
TODO: check
CVE-2026-105331 (Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a u ...)
- TODO: check
+ NOT-FOR-US: Checkmk
CVE-2026-105275 (Satel Netco Design versions prior to v2.1.7 contains a relative path t ...)
TODO: check
CVE-2026-105269 (Satel Netco Design versions prior to v2.1.7 contains a stored cross si ...)
TODO: check
CVE-2026-105190 (The Easy Digital Downloads WordPress plugin before 3.7.1 does not cons ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-105110 (OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox ...)
TODO: check
CVE-2026-105079 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105078 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-105076 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-104704 (Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS ...)
TODO: check
CVE-2026-104671 (The TutorStarter WordPress theme before 4.0.4 does not respect the sit ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-104660 (Missing authorization on COM objects in Progressive Robot hMailServer ...)
TODO: check
CVE-2026-104659 (Missing Host header validation and missing throttling of failed admini ...)
@@ -821,21 +821,21 @@ CVE-2026-103649 (Missing network timeouts in the Linux builds of Progressive Rob
CVE-2026-103647 (Cross-site scripting in the webmail of Progressive Robot hMailServer 6 ...)
TODO: check
CVE-2026-103517 (The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 d ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-103072 (Missing Authorization vulnerability in VillaTheme VillaTheme Core vill ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103070 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin or theme
CVE-2026-103011 (Heap-based buffer overflow in the legacy Blowfish encryption routine ( ...)
TODO: check
CVE-2026-103010 (Heap-based buffer overflow in the legacy Blowfish decryption routine ( ...)
TODO: check
CVE-2026-102784 (Joomla Extension - balbooa.com - CSRF in language installation feature ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102783 (Joomla Extension - balbooa.com - Path Traversal in image preview Gridb ...)
- TODO: check
+ NOT-FOR-US: Joomla
CVE-2026-102368 (Affected Tapo device firmware stores device-specific cryptographic mat ...)
- TODO: check
+ NOT-FOR-US: TPLink
CVE-2026-101998 (Docker Sandboxes could fail open while masking credentials in protecte ...)
TODO: check
CVE-2026-101028 (Incorrect Authorization vulnerability in ash-project ash allows an act ...)
@@ -847,7 +847,7 @@ CVE-2026-100197
CVE-2025-71428 (Jivejdon through 5.0 contains a sql injection vulnerability in Account ...)
TODO: check
CVE-2025-15700 (The AWP Classifieds WordPress plugin before 4.4.9 does not validate th ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2026-97147 (In OpenStack Mistral through 23.0.0, several of the v2 API write paths ...)
- mistral <unfixed> (bug #1150346)
NOTE: https://launchpad.net/bugs/2160267
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3080defe80cbb45cc5b5d763dbe78055bff50dc7
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3080defe80cbb45cc5b5d763dbe78055bff50dc7
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/66c1fea2/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list